Copied from
ubuntu trusty in
Private PPA for Ubuntu Security Team
by Ubuntu Archive Robot
Changelog
php5 (5.5.9+dfsg-1ubuntu4.13) trusty-security; urgency=medium
* SECURITY UPDATE: phar segfault on invalid file
- debian/patches/CVE-2015-5589-1.patch: check stream before closing in
ext/phar/phar_object.c.
- debian/patches/CVE-2015-5589-2.patch: add better checks in
ext/phar/phar_object.c.
- CVE-2015-5589
* SECURITY UPDATE: phar buffer overflow in phar_fix_filepath
- debian/patches/CVE-2015-5590.patch: properly handle path in
ext/phar/phar.c.
- CVE-2015-5590
* SECURITY UPDATE: multiple use-after-free issues in unserialize()
- debian/patches/CVE-2015-6831-1.patch: fix SPLArrayObject in
ext/spl/spl_array.c, added test to ext/spl/tests/bug70166.phpt.
- debian/patches/CVE-2015-6831-2.patch: fix SplObjectStorage in
ext/spl/spl_observer.c, added test to ext/spl/tests/bug70168.phpt.
- debian/patches/CVE-2015-6831-3.patch: fix SplDoublyLinkedList in
ext/spl/spl_dllist.c, added test to ext/spl/tests/bug70169.phpt.
- CVE-2015-6831
* SECURITY UPDATE: dangling pointer in the unserialization of ArrayObject
items
- debian/patches/CVE-2015-6832.patch: fix dangling pointer in
ext/spl/spl_array.c, added test to ext/spl/tests/bug70068.phpt.
- CVE-2015-6832
* SECURITY UPDATE: phar files extracted outside of destination dir
- debian/patches/CVE-2015-6833-1.patch: limit extracted files to given
directory in ext/phar/phar_object.c.
- CVE-2015-6833
* SECURITY UPDATE: multiple vulnerabilities in unserialize()
- debian/patches/CVE-2015-6834-1.patch: fix use-after-free in
ext/standard/var.c, ext/standard/var_unserializer.*.
- debian/patches/CVE-2015-6834-2.patch: fix use-after-free in
ext/spl/spl_observer.c, added test to ext/spl/tests/bug70365.phpt.
- debian/patches/CVE-2015-6834-3.patch: fix use-after-free in
ext/spl/spl_dllist.c, added test to ext/spl/tests/bug70366.phpt.
- CVE-2015-6834
* SECURITY UPDATE: use after free in session deserializer
- debian/patches/CVE-2015-6835-1.patch: fix use after free in
ext/session/session.c, ext/standard/var_unserializer.*
fixed tests in ext/session/tests/session_decode_error2.phpt,
ext/session/tests/session_decode_variation3.phpt.
- debian/patches/CVE-2015-6835-2.patch: add more fixes to
ext/session/session.c.
- CVE-2015-6835
* SECURITY UPDATE: SOAP serialize_function_call() type confusion
- debian/patches/CVE-2015-6836.patch: check type in ext/soap/soap.c,
added test to ext/soap/tests/bug70388.phpt.
- CVE-2015-6836
* SECURITY UPDATE: NULL pointer dereference in XSLTProcessor class
- debian/patches/CVE-2015-6837-6838.patch: fix logic in
ext/xsl/xsltprocessor.c.
- CVE-2015-6837
- CVE-2015-6838
-- Marc Deslauriers <email address hidden> Tue, 29 Sep 2015 07:35:49 -0400